7b813d6dbe619954ee377f645d113390594c36bf960e74a636a5d3563faaac4d

Analysis

max time kernel
140s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3a58eb54284d171e62064257aa3b3a7.exe
Size

385KB
MD5

c3a58eb54284d171e62064257aa3b3a7
SHA1

ed609d7a1ef0ab759a8fe2c73c389518afe0db91
SHA256

7b813d6dbe619954ee377f645d113390594c36bf960e74a636a5d3563faaac4d
SHA512

93e55337b757582643348a864977c5b30d5a83f33432025731595507fcaeebcea3f6ce649f9ae5fdbb0ac4ab2b1c9791eb62536da291345f6cb89b2f15e0134c
SSDEEP

6144:X8ocL+9acFcGF9pERyh75AqJ4bTe2LnK8GYWr43irzjh0z4xsyRRqy+iNxfB:XxcLrcnFRhtT6bT1e8hirzqzmRtFxB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3472	c3a58eb54284d171e62064257aa3b3a7.exe

Executes dropped EXE 1 IoCs

pid	Process
3472	c3a58eb54284d171e62064257aa3b3a7.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	pastebin.com
12	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4776	c3a58eb54284d171e62064257aa3b3a7.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4776	c3a58eb54284d171e62064257aa3b3a7.exe
3472	c3a58eb54284d171e62064257aa3b3a7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 3472	4776	c3a58eb54284d171e62064257aa3b3a7.exe	88
PID 4776 wrote to memory of 3472	4776	c3a58eb54284d171e62064257aa3b3a7.exe	88
PID 4776 wrote to memory of 3472	4776	c3a58eb54284d171e62064257aa3b3a7.exe	88

C:\Users\Admin\AppData\Local\Temp\c3a58eb54284d171e62064257aa3b3a7.exe
"C:\Users\Admin\AppData\Local\Temp\c3a58eb54284d171e62064257aa3b3a7.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Users\Admin\AppData\Local\Temp\c3a58eb54284d171e62064257aa3b3a7.exe
  C:\Users\Admin\AppData\Local\Temp\c3a58eb54284d171e62064257aa3b3a7.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c3a58eb54284d171e62064257aa3b3a7.exe

Filesize
385KB

MD5
b76bc9e1db26d677018d8f2e6d56993f

SHA1
d396ee5574f4c1d6b9a29d728c56d85cebbe7121

SHA256
4086820f389cc58f6babd0099840f63b807de7629407a0d532bd298cfca954fb

SHA512
c79a083281a3684504ba72cee3f382479ec25994c4dac33c28ccf0739045e7c6ef2ab992d43f5a9ad4b1faeae94ea2f7ff355500da76d946ce0a30deeca72420

Download Submit
memory/3472-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3472-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3472-16-0x0000000000150000-0x00000000001B6000-memory.dmp

Filesize
408KB

Download
memory/3472-20-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3472-22-0x00000000026F0000-0x000000000274F000-memory.dmp

Filesize
380KB

Download
memory/3472-35-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3472-36-0x000000000C640000-0x000000000C67C000-memory.dmp

Filesize
240KB

Download
memory/3472-37-0x000000000C640000-0x000000000C67C000-memory.dmp

Filesize
240KB

Download
memory/4776-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4776-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4776-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/4776-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download